Bug 2545291 (CVE-2026-104848)

Summary:	CVE-2026-104848 tinypool: tinypool: arbitrary code execution via prototype pollution in worker options
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anujha, asoldano, ataylor, bbaranow, bmaxwell, bstansbe, cdrage, csuconic, dbruscin, dlofthou, dschmidt, ehugonne, gtully, ikhan, istudens, ivassile, iweiss, jlanda, jsherman, kshier, kvanderr, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rbobbitt, rgemmell, rgodfrey, rstancel, rushinde, simaishi, stcannon, tbish, thjenkin, tlavocat, vdosoudi, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties (prototype pollution), tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup arguments or environment variables, resulting in arbitrary code execution with the privileges of the host process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 16:32:25 UTC

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.